CVE-2026-39820: Quadratic string concatentation in consumeComment in net/mail
Quadratic string concatentation in consumeComment in net/mail
Other sources
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.25.10-r0 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.3-r0 - Upgrade
Upgrade
alpine/rcloneto a version that resolves this vulnerability.Fixed in 1.74.1-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39820?
CVE-2026-39820 is classified as a moderate severity vulnerability due to its potential for CPU exhaustion and memory allocation issues.
How do I fix CVE-2026-39820?
To fix CVE-2026-39820, update the golang/net/mail package to the latest version where the vulnerability has been addressed.
What impact does CVE-2026-39820 have on system performance?
CVE-2026-39820 can lead to significant performance degradation, causing excessive CPU usage and memory allocation during specific input handling.
Which versions of golang/net/mail are affected by CVE-2026-39820?
CVE-2026-39820 affects older versions of the golang/net/mail package prior to the vulnerability fix in later updates.
Can CVE-2026-39820 be exploited remotely?
Yes, CVE-2026-39820 can potentially be exploited remotely if an attacker sends specially crafted inputs to the affected functions.